Grocy Project maintains a single, focused open-source inventory and household-management application that occupies a modest but notably engaged position in the self-hosted and home-automation landscape. The recurring vulnerability surface centers on web-application input handling and session management, with durable signals in cross-site scripting, cross-site request forgery, forced browsing, and injection-class flaws that are characteristic of web frameworks handling untrusted user input. A meaningful share of the vendor's disclosures reach serious severity; live exploitation activity and current exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Grocy Project over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-55074CRITICAL The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370. | Jan 6, 2025 | 9.0 | 24 | NO | NO |
CVE-2023-42270HIGH Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF). | Sep 15, 2023 | 8.8 | 24 | NO | NO |
CVE-2023-48199HIGH HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-su | Nov 15, 2023 | 7.8 | 23 | NO | NO |
CVE-2024-55076HIGH Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. | Jan 6, 2025 | 8.1 | 22 | NO | NO |
CVE-2024-8370MEDIUM A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File U | Sep 1, 2024 | 5.4 | 19 | NO | NO |
CVE-2023-48198MEDIUM A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to obtain a victim's cooki | Nov 15, 2023 | 5.4 | 19 | NO | NO |
CVE-2023-48197MEDIUM Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see | Nov 15, 2023 | 5.4 | 19 | NO | NO |
CVE-2020-25454MEDIUM Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe. | Nov 18, 2020 | 5.4 | 18 | NO | NO |
CVE-2024-55075MEDIUM Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes. | Jan 6, 2025 | 5.3 | 17 | NO | NO |
CVE-2023-48866MEDIUM A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 | Dec 4, 2023 | 5.4 | 17 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Grocy Project.
Media articles that mention a CVE ID that affects a product developed by Grocy Project — matched by CVE ID, not by vendor name.